Senator Ron Wyden introduced new legislation Tuesday requiring the Federal Communications Commission (FCC) to implement strict cybersecurity regulations for telecommunications companies, following major Chinese breaches by Chinese hackers known as Salt Typhoon.
The Secure American Communications Act comes in response to what experts call the worst breach in U.S. telecommunications history, where Chinese government-linked hackers infiltrated major carriers like AT&T, Verizon, and Lumen. The hackers reportedly still maintain access to some systems.
The proposed bill would mandate that the FCC create binding cybersecurity rules within one year, working alongside the Cybersecurity and Infrastructure Security Agency and the Office of the Director of National Intelligence.
Key requirements in the legislation include:
- Annual security testing of telecom systems
- Independent auditor assessments
- Documentation of security measures
- Compliance statements from company executives
- Regular vulnerability patches
"Telecom companies and federal regulators were asleep on the job," said Wyden, highlighting how Americans' calls, messages and phone records were compromised by foreign spies.
The bill builds upon the 1994 Communications Assistance for Law Enforcement Act (CALEA), which originally included security requirements that were never fully implemented by the FCC. Last week, FCC Chairwoman Jessica Rosenworcel released a draft proposal for similar regulations.
While Congress is expected to adjourn next week, pushing substantial action on the Salt Typhoon response to 2024, the bill represents mounting pressure on both telecom companies and regulators to address critical infrastructure vulnerabilities.
The legislation follows other recent moves by Wyden, including a joint letter with Senator Eric Schmitt urging the Defense Department to strengthen cybersecurity measures for its telecommunications carriers.